Key vocabulary

Part 1 — Tracking cookies

What is a cookie?

When you visit a website, it can store a small text file called a cookie in your browser. Cookies are used for many legitimate purposes: keeping you logged in, remembering items in a shopping basket, or saving your language preferences. These are called first-party cookies because they are set by the website you are actually visiting.

A third-party cookie is different — it is set not by the site you are on, but by another organisation whose code appears on that page. Advertising networks and analytics companies embed code on thousands of websites, which allows them to set cookies in your browser whenever you visit any of those sites.

How tracking cookies follow you across websites

When an advertising company's code runs on a page, it checks whether you already have one of its cookies. If you do not, it creates one with a unique identifier — a random ID code that identifies your browser. If you already have the cookie, it reads the ID and records which website you just visited, linking that visit to your ID.

Because the same advertising company's code appears on thousands of websites, it can build up a detailed picture of where you browse. This is a tracking cookie — a cookie whose purpose is not to make the current website work, but to track your behaviour across many different sites.

What happens to the data?

Over time, a tracking profile associated with your unique ID might include: which news topics you read, which products you browsed, which travel destinations you searched for, and which health conditions you looked up. This profile is used to serve you targeted advertisements — adverts that match your apparent interests. The profile may also be sold to other companies.

Privacy implications

Tracking cookies raise significant privacy concerns. Users are often unaware their browsing behaviour is being monitored. The data collected can reveal sensitive information — health concerns, financial difficulties, political views — without users ever consenting to share it. Under the UK GDPR, websites must ask for consent before storing non-essential cookies, which is why cookie banners appear on most websites. However, many users click "Accept All" without reading the options, giving broad consent without intending to.

Most modern browsers allow users to block third-party cookies. Browsing in private or incognito mode prevents cookies from persisting after the session ends, limiting tracking — though it does not make you invisible to the websites you visit.

Part 2 — Denial of Service attacks

What is a DOS attack?

Every web server has a limit on how many requests it can handle at once. It has a finite amount of processing power, memory, and network bandwidth. A Denial of Service (DOS) attack deliberately exploits this limit by flooding the server with far more requests than it can process.

When the server is overwhelmed, it cannot respond to legitimate users. The service becomes unavailable — the website goes down, error messages appear, or connections time out. The attacker has not broken into the system or stolen data; they have simply rendered it inaccessible.

How a DOS attack works

In a simple DOS attack, a single computer belonging to the attacker sends an extremely high volume of requests — potentially thousands per second — to the target server. The server must attempt to process each one. As its resources are exhausted, it slows down and eventually stops responding to legitimate requests entirely.

Symptoms of a DOS attack

From a user's point of view, a DOS attack shows up as two main symptoms: slow performance (pages take far longer than normal to load, or load only partially) and inability to access the service at all (the connection times out, or an error page is shown). Neither symptom on its own proves an attack is happening — ordinary high demand can look similar — but a sudden, sustained combination of both is a strong indicator.

Distributed DOS (DDOS) attacks

A single attacker's computer has limited bandwidth, so a server with sufficient capacity can potentially handle a simple DOS attack by filtering or rate-limiting that source. A Distributed DOS (DDOS) attack overcomes this limitation by using a botnet — a network of thousands of infected computers, each sending requests simultaneously.

Each computer in the botnet (called a zombie) sends requests that individually look no different from normal traffic. But thousands of zombies together generate a combined volume of traffic that overwhelms even large, well-resourced servers. Because the requests come from thousands of different IP addresses, simply blocking one address does nothing — there are thousands more.

The owners of zombie computers are typically unaware their machine is part of an attack. The malware that recruits them usually runs silently in the background.

Type of fault

Not every DOS attack overwhelms a server in the same way. The Higher course names three specific types of fault:

• Bandwidth consumption — the attacker simply sends more traffic than the target's network connection can carry, so the connection itself becomes the bottleneck. Even a server with spare processing power cannot respond if the traffic never gets through.
• Resource starvation — rather than saturating the network, the attacker sends requests specifically designed to consume the server's processing power, memory, or the limited number of connections it can track at once, exhausting those resources even though bandwidth is not the limiting factor.
• Domain Name Service (DNS) — instead of attacking the web server directly, the attacker floods the DNS servers responsible for translating the website's domain name into an IP address. If the DNS servers cannot respond, users' browsers cannot find the website's address at all, denying access even if the web server itself is still running normally. This is different from DNS spoofing, which redirects users to a fake site rather than denying service.

Effects of a DOS or DDOS attack

The effects of an attack are the disruption caused to users and the business itself:

• Service unavailability — the website or application cannot be reached by users
• Reputational damage — customers lose trust in a service that appears unreliable
• Staff disruption — if internal systems are targeted, employees cannot use them to work

Costs of a DOS or DDOS attack

Separate from the disruption itself, an attack has a financial cost to the organisation:

• Lost revenue — an e-commerce site that is down cannot process orders or payments
• Labour in rectifying the fault — technical staff time is needed to identify the attack, mitigate it, and restore the service

Reasons for DOS attacks

Attackers launch DOS attacks for different underlying reasons:

• Financial — an attacker may demand a ransom to stop the attack, or a competitor may attack a rival business to damage its trade during a busy period.
• Political — an attacker (sometimes called a "hacktivist") may target a government or organisation's website to protest a policy or draw attention to a cause.
• Personal — an attacker may hold a grudge against a specific person or organisation, or may attack simply to demonstrate their ability and gain notoriety among other attackers.

Worked examples

The step-by-step tracking process can be shown as a pipeline:

Task Set A

Task Set B